Overview

overview

10

Static

static

10

c (2).exe

windows10-2004-x64

10

c (2).exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    c (2).exe
  • Size 3.4MB
  • Sample261017-xe2lnabs8l
  • SHA256 cdcac21a813fa0c09c59b1e62e62e589d6fa462ba6ecaf395216f855c88c2e4a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
examrattrojanbackdoormeshagent

Malware Config

Extracted

Family

  • meshagent

Version

  • 2

Botnet

  • exam

C2

  • http://derricksolutions.org:8888/agent.ashx

Attributes
  • mesh_id

    0x66F82AF3ACF3BE7EB61C11C99FFC72EEA59A710F335CEF3137B06EA5F073B62066485165506D68B9DC338750C43B8EA6

  • server_id

    B7BB7D95D655EF092DBF31B2119E0BCCEE89CD100766F650D0AF9E74E27A0F33052EF5DF0166E43CF9C2E1553CBC4B8E

  • wss

    wss://derricksolutions.org:8888/agent.ashx

Signatures

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent
  • Detects MeshAgent payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • c (2).exe
    .exe 3.4MB

c (2).exe

  • IMPHASH 4b47ca07e6b1f35b0c1196272a5db50d
  • SHA256 cdcac21a813fa0c09c59b1e62e62e589d6fa462ba6ecaf395216f855c88c2e4a
  • MD5 SHA1 SHA512 SSDEEP TLSH
windows:6windowsx64arch:x64

  • Detects MeshAgent payload

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
1973100
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\seraj\source\repos\Meshglass_1.0.2\MeshAgent-master\Release\MeshService64.pdb